CVE-2015-7257: ZTE ZXV10 w300 Firmware

High severity, CVSS 7.5. EPSS: 6.7% chance of exploitation in the next 30 days.

ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated non-administrator users to change the admin password by intercepting an outgoing password change request, and changing the username parameter from "support" to "admin".

Affected products

• ZTE ZXV10 w300 Firmware: version w300v2.1.0f_er7_pe_o57 only; version w300v2.1.0h_er7_pe_o57 only

Published 2017-08-24. Last modified 2026-06-17.